RDF Triple Sensitivity Label Management for Data Security
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
RDF databases lack effective data security mechanisms to manage sensitivity labels, particularly in securing individual triples without affecting other records and handling inferred relationships, limiting their applicability in various tasks.
Innovation Solution
Implementing a method to set and manage sensitivity labels for resources within RDF triples, restricting their usage and access, by generating labels based on the restrictions of component resources in the subject, predicate, and object positions, and applying these labels to both explicitly added and inferred triples to ensure uniform access control.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If sensitivity labels are applied to individual triples in RDF databases, then data security and access control are improved, but device complexity increases due to the need to manage labels for subject, predicate, and object components
Solution Approach 1:
The sensitivity label is segmented into three independent components: subject label, predicate label, and object label. Each component can be managed and assigned independently, allowing fine-grained control over different parts of the triple while reducing the overall management complexity compared to a single monolithic label system.
Solution Approach 2:
Different sensitivity labels are applied to different components (subject, predicate, object) based on their specific security requirements. This allows each component to have its own security characteristics and access control rules, enabling localized security management rather than uniform treatment of the entire triple.
2Reliability
If access control is applied to inferred triples, then data security is improved, but ease of operation deteriorates due to the complexity of determining labels for inferred relationships
Solution Approach 1:
Sensitivity labels are assigned to the components (subject, predicate, object) before the triple is created or before inference occurs. This preliminary labeling allows the access control system to automatically determine the appropriate label for inferred triples based on the pre-assigned component labels, eliminating the need for manual label assignment for inferred relationships.
Solution Approach 2:
The system automatically determines the sensitivity label for inferred triples by deriving it from the labels of the component resources. This self-service mechanism eliminates the need for manual intervention to assign labels to inferred relationships, making the access control operation easier while maintaining security.
3Reliability
If row level and column level security labels are used in relational databases, then data protection is improved, but adaptability deteriorates because table-based structures cannot efficiently handle unstructured or sparse data
Solution Approach 1:
The patent replaces the mechanical table-based relational structure with an RDF graph structure that uses triples to represent data. This substitution allows the system to handle unstructured and sparse data efficiently while maintaining security through sensitivity labels applied to individual triples, combining the flexibility of graph data models with the security of labeled access control.
Data Source
AI summary
Systems, methods, and other embodiments associated with resource description framework (RDF) security are described. One example method includes generating, based on sensitivity labels associated with the contents of a triple in an RDF record, a sensitivity label. The example method may also include comparing the sensitivity label to an access label associated with an entity requesting an action associated with the record to be performed. The example method may also include performing the action upon determining that the entity has sufficient permission to request the action.